Big crypto exchanges like Coinbase take the safety of their clients coins very seriously. Process of creating thousands of private keys keys start in Faraday tent at randomly chosen secure location. They have two laptops and one is chosen by flip of a coin, and device is destroyed after the process is over. Then they use armored vehicles to transfer those printed keys to secure location, and backups are send at multiple locations around the world.

So most of users coins (around 98%) is offline an it is stored on paper, at least this is case with this exchange.

https://www.wired.com/story/coinbase-physical-vault-to-secure-a-virtual-currency/